Add SDK v2 tool-server assembly with shared registration core

[RhysSullivan]

Second step of MCP spec 2026-07-28 support: the executor tool server now builds on either SDK generation.

• tool-server-shared.ts: SDK-agnostic core (schemas, handler bodies, artifacts, registration flow) extracted from tool-server.ts; the v1 assembly keeps its exact public API and behavior — every pre-existing test passes unmodified.
• tool-server-v2.ts: new buildMcpServerV2 assembling the same tools on @modelcontextprotocol/server@2 for stateless per-request serving. Native elicitation returns input_required with signed requestState (HMAC via createRequestStateCodec, bound to method + authenticated principal per the spec MUST, TTL-limited) riding the existing pause/resume engine; model/browser modes are unchanged logic.
• mcp-apps.ts: temporary wire-identical vendoring of the ext-apps server helpers (upstream v2 support still open: Migrate ext-apps to @modelcontextprotocol/server v2 SDK modelcontextprotocol/ext-apps#702); the v1 assembly keeps the real dependency.
• No host wiring yet — hosts route modern traffic to buildMcpServerV2 in the next PRs.

Tests: 197 in packages/hosts/mcp (9 new v2/apps files), incl. input_required round-trips, tampered and cross-principal requestState rejection, apps-enabled/disabled variants.

Stacked on #1591.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	executor-marketing	e4d0c8d	Commit Preview URL Branch Preview URL	Aug 16 2026, 11:59 AM

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	executor-cloud	e4d0c8d	Aug 16 2026, 12:00 PM

[github-actions]

Cloudflare preview

Torn down — the PR is closed.

[pkg-pr-new]

Open in StackBlitz

@executor-js/cli

npm i https://pkg.pr.new/@executor-js/cli@1601

@executor-js/config

npm i https://pkg.pr.new/@executor-js/config@1601

@executor-js/execution

npm i https://pkg.pr.new/@executor-js/execution@1601

@executor-js/sdk

npm i https://pkg.pr.new/@executor-js/sdk@1601

@executor-js/codemode-core

npm i https://pkg.pr.new/@executor-js/codemode-core@1601

@executor-js/runtime-quickjs

npm i https://pkg.pr.new/@executor-js/runtime-quickjs@1601

@executor-js/plugin-file-secrets

npm i https://pkg.pr.new/@executor-js/plugin-file-secrets@1601

@executor-js/plugin-graphql

npm i https://pkg.pr.new/@executor-js/plugin-graphql@1601

@executor-js/plugin-keychain

npm i https://pkg.pr.new/@executor-js/plugin-keychain@1601

@executor-js/plugin-mcp

npm i https://pkg.pr.new/@executor-js/plugin-mcp@1601

@executor-js/plugin-onepassword

npm i https://pkg.pr.new/@executor-js/plugin-onepassword@1601

@executor-js/plugin-openapi

npm i https://pkg.pr.new/@executor-js/plugin-openapi@1601

executor

npm i https://pkg.pr.new/executor@1601

commit: e4d0c8d

[RhysSullivan]

Folded into #1611 (single consolidated PR per review preference).